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APOLLO EXPERIENCE REPORT 

DESCENT PROPULSION SYSTEM 

By William R. Hammock, Jr., Eldon C. Currie, 
and Arlie E. Fisher 
Manned Spacecraft Center 

SUMMARY 


The propulsion system for the descent stage of the lunar module was designed to 
transfer the fully loaded lunar module containing two crewmen from the lunar parking 
orbit to the lunar surface and to hover above the lunar surface for exact landing-site 
selection. To accomplish this maneuver, a propulsion system was developed that used 
hypergolic propellants and a gimbaled pressure-fed ablatively cooled engine that was 
capable of being throttled. A lightweight cryogenic helium pressurization system also 
was used. During the developmental and operational phases of the program, signifi- 
cant problems were encountered with long-term propellant compatibility, seal leakage 
of the propellant system, the supercritical helium system, and interfaces with the 
guidance and navigation system. 


INTRODUCTION 


The mission requirements for the Apollo descent propulsion system (DPS) were 
to provide the necessary change in velocity (AV) for transfer of the lunar module (LM) 
from lunar orbit to descent orbit and for the powered descent from descent orbit to 
lunar-surface landing. A secondary mission requirement was to provide contingency 
abort capability for return to earth if the service propulsion system (SPS) in the 
command-service module failed during translunar and prelanding lunar-orbit phases 
of the mission. The history of the DPS design and development covers a period of ap- 
proximately 7 years from conception to the first manned lunar- landing mission 
(Apollo 11). The technical problems encountered during the development of the DPS 
and the solutions developed for the problems are presented. 


MISSION REQUIREMENTS 


Initially, the DPS requirements were defined by a 26 000-pound LM separation 
weight and a AV requirement of approximately 6000 fps. Later, as the vehicle design 
was defined better, the requirements were increased to approximately a 33 000-pound 
LM separation weight and a 7000- fps AV requirement for landing. 



The nominal mission requirements included a passive standby of the DPS from 
launch through translunar coast and lunar-orbit coast (approximately 100 hours), a 
burn to accomplish a Hohmann transfer from a 60-nautical-mile circular lunar orbit 
to a 60-nautical-mile by 50 000-foot elliptical descent orbit, and a powered-descent 
burn from 50 000 feet to lunar-surface landing. The powered-descent burn consisted 
of a variable-thrust profile (fig. 1) that dictated the requirement for an engine capable 
of being throttled. The hover phase included the last 1000 feet of descent to the lunar 
surface. Because the mission was to be manned, very high system reliability was 



Figure 1.- Powered- descent 
variable-thrust profile. 


another design requirement . Also, the 
DPS was required to provide contingency 
mission-abort capability if loss of the 
SPS occurred during translunar coast, 
lunar-orbit insertion, or early lunar-orbit 
coast. 

To achieve the optimum design for 
the mission requirements (reliability, 
performance, and weight), a pressure-fed 
storable-propellant propulsion system 
using an ablatively cooled engine was se- 
lected for the DPS . In addition to the 
throttling requirement for the terminal 
phase of descent, the DPS engine was 
required to be gimbaled to provide thrust- 
vector control. The propellants selected 
were nitrogen tetroxide (NgO^) (oxidizer) 

and 50 percent unsymmetrical dimethyl 
hydrazine (UDMH) and 50 percent hy- 
drazine (fuel). 


SYSTEM DESCRIPTION 


The initial DPS design was defined in 1963 (fig. 2). Later, as the system re- 
liability, weight, and component designs were refined, the DPS design changed (fig. 3). 
An explanation of these changes is discussed in this paper. 
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Figure 2.- The initial DPS design. 
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Pressurization System 

fLje| The initial concept of the DPS pres- 

heuum surization system used helium stored in 

heat two high-pressure tanks with pressure 

exchanger control and supply components (fig. 2). 

Helium was to be stored at 4500 psia but 
later was changed to 3500 psia to optimize 
system weight. 

As the design of the lunar module 
progressed, vehicle weight became a criti- 
cal factor; therefore, a feasibility study 
was initiated early in 1964 to evaluate the 
use of a supercritical helium (SHe) storage 
tank in the pressurization system. The 
concept consisted of storing very dense 
helium at approximately 10° Rina highly 
thermally insulated pressure vessel. Pres- 
sure in the storage tank was allowed to 
rise because of the heat leak into the tank 
(approximately 8 to 10 Btu/hr). As heli- 
um was used from the tank, additional heat 
would be provided to the helium in the tank 
to raise further the pressure by the use of 
an external fuel-to-helium heat exchanger 

Figure 3. - The final DPS design. and an internal helium-to-helium heat ex- 

changer within the tank through which the 
total helium flow passed. Subsequently, 
the helium was routed through a second pass in the fuel-to-helium heat exchanger to 
raise the helium temperature to nearly ambient conditions (approximately 40° F) be- 
fore it was supplied to the pressure regulators in the pressurization system. 

By late 1964, the analysis and feasibility testing of the SHe system indicated that 
it was operationally feasible and that a weight savings of 280 pounds could be realized 
by using the SHe system rather than the ambient-storage system. In February 1965, 
a decision was made to redesign the DPS pressurization system to incorporate an SHe 
storage tank (fig. 3). Because the pressure in the SHe storage tank increased with 
time, a minimum- required standby time was defined as 131. 5 hours from prelaunch 
topoff until first usage in the nominal lunar landing. 

As a result of developmental problems and reassessment of reliability require- 
ments, a decision was made in October 1966 to use only parallel redundancy in the 
pressure regulation system (single regulators in each leg). The rationale for this 
decision was that if a wide-open regulator failure occurred, the propellant tanks would 
be protected from overpressurization by the relief valves, and the crew, using the 
latching solenoid valve, could eventually isolate the failed regulator. This factor would 
save the system, and the mission could be continued on the second regulator or could 
be aborted with the ascent propulsion system. To achieve required engine performance, 
another design change was made to increase the regulated pressure level from 210 psia 
to 246 psia. 
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During design and development of the SHe pressurization system, freezing of the 
fuel in the fuel-to-helium heat exchanger was found to occur during the start sequence 
under certain start conditions. The freezing condition was caused by the flow of a 
substantial amount of helium needed to bring the propellant tanks from prepressuriza- 
tion levels to regulator lockup pressure conditions, during which time no fuel was 
flowing through the fuel passages of the heat exchanger. A study was made of various 
systems to alleviate the flowing of cold helium with no fuel flow. An ambient-helium 
prepressurization start bottle and an electrical heater system were the two main meth- 
ods considered. The use of an ambient-helium prepressurization start bottle was se- 
lected for overall simplicity and reliability. 


Propellant Storage and Feed System 


The LM vehicle configuration used four propellant -storage (two oxidizer and 
two fuel) tanks for optimum center of gravity (c.g. ) and weight control. The identical 
propellant tanks were fed in parallel to minimize c.g. excursion during propellant us- 
age. Balance lines were provided at the top and bottom of the two identical tanks to 
ensure balanced propellant flow from each tank. For overpressurization protection, 
a burst-disk assembly and relief-valve assembly were provided in the pressurization 
line leading to each pair of tanks. The burst-disk assembly was in series with the 
relief -valve assembly to provide a posi- 
tive seal against leakage until actuation 


of the relief system was needed. In the 
initial design of the burst disk and relief 
valve, an integral assembly was used 
that incorporated a frangible disk and 
cutter arrangement (fig. 4). Because 
the burst pressure for this design was 
not repeatable, the maximum tank pres- 
sure was 308 psia. The burst-pressure 
rating of this design disk was 288 ± 

20 psia, which was based on lot-sample 
testing and qualification testing. The 
safety margin of the propellant tank 
(1.3 safety factor to burst) was limited 
severely with this design. Also, the 
fracture-flaw growth potential caused by 
pressure cycling (fracture mechanics) 
was more critical than normal, thereby 
limiting the allowable pressure cycles 
on the tanks during checkout, servicing, 
and flight. 

A newly designed burst disk 
(fig. 5) with a burst-pressure setting of 
267. 5 ± 7. 5 psia was selected to improve 



Figure 4.- Burst-disk and relief -valve 
assembly. 


the design safety margins and pressure- cycling limitations on the propellant tanks. 
Another desirable feature of the newly designed burst disk was the ability to withstand 
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Housing 


inlet 




Outlet 


Figure 5. - The new burst-disk assembly. 


reverse-pressure differentials (approximately 150 psid) without incurring damage. 
Before selection of the new design, many failures of the old burst disk occurred in 
checkout as a result of inadvertent reverse pressure. 

During the design of the DPS and the evaluation of the operation of the DPS during 
a lunar mission, a determination was made that heat soakback from the engine after 
lunar landing could cause the propellant tanks surrounding the engine compartment to 
warm, thus causing the pressure to rise to burst-disk and relief -valve pressures. 

Heat soakback could have caused venting of propellant vapors through the relief valves 
during astronaut extravehicular activity on the lunar surface, thus spraying the astro- 
nauts with propellant vapors. As a result of this possibility, a propellant-tank lunar- 
dump system was added to each propellant-storage system. This system consisted of 
an explosive valve and latching solenoid valve in series in a bypass line around the 
burst-disk and relief-valve assemblies. Actuation of the explosive valve and latching 
solenoid valves was controlled from the LM crew station. 

In each of the four propellant tanks , a propellant-quantity gaging probe provided 
continuous monitoring from 0 to 95 percent of the tank capacity. Integral to the 
propellant-quantity probes was a propellant low-level detector that provided a crew 
warning of impending propellant depletion as the propellant quantity reached a discrete 
value of 5. 6 percent in any tank. 
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Descent Engine 

The basic design requirements for the descent engine were as follows. 

1. Throttling ratio: 10:1 

2. Maximum-rated thrust: 10 500 1b 

3. Gimbaling: +6° in the Y and Z axes 

4. Duty-cycle life: 1000 sec 

5. Pressure fed: 210 psia (later changed to 246 psia) 

6. Propellants: N 0 O A (oxidizer); 50 percent UDMH and 50 percent hydrazine 

(fuel) 1 4 

7. Specific impulse (end of duty cycle): 305 lb^-sec/ lb m 

The descent engine was located in the central bay of the descent stage and was 
partially buried (up to 16:1 expansion ratio). Because of this location, an engine de- 
sign with sufficient cooling was needed to prevent overheating of the surrounding pro- 
pellant tanks during engine operation. In the initial phases of engine-design definition 
and development, two different throttling concepts were considered. 

One throttling concept used a fixed-area injector with helium injection at reduced 
thrust to maintain adequate combustion efficiency. Propellant-flow variation was con- 
trolled by noncavitating throttling valves that used system fuel pressures (fig. 6) to 
actuate the hydraulic servocontrol valves. 

The other throttling concept used a variable-area injector combined with 
cavitating-venturi propellant-flow-control valves. This injector was a coaxial center- 
element design. A single movable sleeve was used to modulate the injector-fuel and 
oxidizer-flow area. This injector sleeve was linked mechanically to the two cavitating- 
f low-control valves and the electrically driven throttle-actuator assembly. 

After approximately 18 months of parallel engine development by two different 
contractors using these two throttling concepts, the variable-area-injector throttling 
concept was selected (January 1965). The final design configuration of this injector is 
shown in figure 7. The basic reasons for this selection were that the fixed-area in- 
jector with helium injection experienced significant problems with combustion instabil- 
ity during development, and reduced-thrust performance was lower than that with the 
variable-area injector. 

Maximum-operational thrust occurred at a fixed throttle point (FTP) that was 
calibrated for optimum-mixture ratio and injector pressure difference in settings. The 
FTP was optimized at 92. 5 percent of maximum-rated thrust (10 500 lb). The initial 
design attempted to provide variable thrust near the maximum-rated thrust; however, 
excessive problems with mixture-ratio control and throat erosion caused the selection 
of an FTP maximum -thrust setting, which was compatible with mission requirements. 
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Fuel-inlet Drain port (typ) 

customer interface 


Oxidizer-inlet 
customer interface 



Fixed-area injector 


Combustion chamber 


Figure 6.- Descent-engine schematic, fixed-area 
helium injection. 



Figure 7. - Variable area of the descent engine. 



Thrust between 65 and 92. 5 percent was considered a nonoperating region, although the 
engine can be physically throttled to any point in that region. The minimum-throttle 
point was 10 percent of the rated thrust. 

The fuel-actuated shutoff valves were parallel-series redundant ball valves to 
provide fail-safe capability. The fuel and oxidizer injector manifold was sized to 
achieve an oxidizer lead during the start transient. 

The thrust chamber was ablatively cooled to an area ratio of 16:1. The nozzle 
extension was a sheet-metal columbium-alloy skirt extending from 16: 1 to 47. 5: 1 area 
ratio. Cooling of the nozzle extension was by radiation. 

The throttle actuator was a triple- redundant, electrically driven device. Accom- 
plished by an electrical-null-balance method, direct-current command signals were 
compared to throttle-position indication and throttle-position control. A more detailed 
description of the throttle actuator is provided in reference 1 . 

DEVELOPMENT AND QUALIFICATION 


The development and qualification of the DPS in support of the first lunar- landing’ 
mission covered a period of approximately 6 years from August 1963 to April 1969. 
This period included component-level and system-level development and qualification. 
In many cases, preproduction configurations of components were used in early system- 
level developmental testing. In the developmental and qualification testing of compo- 
nents and systems, extensive design- limits tests, off-limits tests, and malfunction 
tests were used to determine potential design deficiencies and to document operational 
limits of the system. 


Pressurization System 

Developmental tests of the SHe system were initiated with an early design- 
feasibility-test rig for evaluation of the flight-system and the ground-support-equipment 
(GSE) design. Caused by the unique SHe tank-loading requirements, development of the 
SHe servicing system was an integral part of the overall development of the SHe system. 

Cryogenic-helium storage vessel . - The design and development of the SHe flight 
tank was initiated by the vendor in May 1965. In the early developmental phase, a pre- 
production tank configuration was used that had a slightly larger internal volume and 
that incorporated an unsupported (other than inlet and outlet tubes) coil-type internal 
heat exchanger. 
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The principal design deficiency in the preproduction tank was the internal heat- 
exchanger configuration. Because of the relatively unsupported configuration of the 
heat exchanger, it was very sensitive to the flight- vibration environment and caused a 
large amplification of vibrations at certain frequencies. Also, the thermal perform- 
ance (heat leak) of the SHe tank was affected significantly by large-pressure oscilla- 
tions in the circuit of the heat exchanger caused by a thermoacoustical phenomenon. 

The phenomenon resulted in an oscillating pressure wave passing through the internal 
heat exchanger. To correct this problem, a small interconnecting line was added be- 
tween the heat- exchanger inlet and outlet lines just outside the tank, thus damping the 
oscillations. This interconnection presented another problem in that the interconnect- 
ing line provided a path that permitted continuous circulation through the internal heat 
exchanger and an attendant degradation in the thermal performance of the tank. 

Developmental tests at White Sands Test Facility (WSTF) on preproduction tanks 
proved that this circulation phenomenon was a function of the vertical heat -exchanger 
orientation and the associated head difference between inlet and outlet lines . As a 
result of circulation, pressure-rise rates as high as 200 psi/hr were detected. In the 
production tank, the internal heat exchanger was reconfigured to a fully supported 
(from inner-vessel wall) coil in the lower half of the tank with the inlet- and outlet-tube 
penetrations going through the bottom of the inner vessel. The interconnecting line was 
still required to prevent the pressure oscillations in the heat -exchanger circuit. 

In the first production-tank configuration, the copper pinch-off tube for the 
vacuum annulus had an excessive pressure rating that would rupture the outer shell in 
the event of a gross helium leak into the annulus from the inner vessel. The tube was 
redesigned and tested to provide a lower relieving pressure (within outer-shell limits), 
and all production tanks were retrofitted or fitted with the new pinch- off tube. 

During the handling and acceptance tests, the outer shell collapsed several 
times in local areas. The most prevalent location of local collapsing was around the 
penetration of the heat- exchanger tubes through the outer shell. No definite conclusions 
were reached concerning the cause of the collapse other than the fact that some tanks 
were marginal in outer-shell strength. As a result of the collapse, the external 
pressure-proof test on the outer shell during acceptance testing was reduced from 
19. 5 psia to 18.5 psia. However, this reduced pressure did not completely eliminate 
occurrences of collapsing. Collapsed tanks were refurbished by installing new outer 
shells . 
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The dual burst-disk assembly on the SHe tank was designed with stainless-steel 
belleville washer springs (17-7 PH) that controlled the burst-pressure setting of the 
burst disk. During certain vehicle checks on an SHe tank, the primary disk ruptured 
at approximately 300 psi below the set pressure of 1881 to 1967 psia. This rupture 
was traced to stress corrosion of the belleville springs caused by long-term exposure 
to moisture. One spring of the four-spring stack was cracked completely through; 
thus, the preload on the burst disk (fig. 8) was lowered. If moisture was detected by a 
vacuum -dryness check, a pressure-proof test was performed on all production burst 
disks. Also, desiccant bags were maintained on the outlet tube of all burst disks after 
the dryness check and the pressure-proof test. Subsequent to LM-5 (Apollo 11), on 
some vehicles the burst disk was modified to incorporate an Inconel belleville spring, 
which is resistant to stress corrosion. 



I 
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Figure 8. - The SHe tank burst disk. 
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Supercritical helium GSE . - The principal items that were developed for serv- 
icing the SHe system were an SHe conditioning unit and a liquid-helium dewar. Among 
the design requirements of this equipment were that the automatic checkout equipment 
(ACE) could remotely control and monitor the equipment and that the equipment could 
meet the size and weight limitations required for placement close to the LM SHe tank 
(on the launch-pad mobile -service structure). These two requirements were signifi- 
cant constraints in the development of this equipment. 

In the initial design of the liquid-helium dewar, the structural support of the 
inner vessel was marginal. During trucking of one dewar with a full load of liquid 
helium, the inner vessel vibrated so badly that the fill and discharge tube at the bottom 
of the tank was cracked, and it released liquid helium into the annulus, thus imploding 
the inner vessel to release the expanded helium (the outer vessel relief was not ade- 
quate). Subsequently, the dewar was modified to increase the stiffness of the bumper 
pads and to improve the suspension- cable arrangement in the annulus. 

Fuel-to-helium heat exchanger . - The development of a two-pass fuel-to-helium 
heat exchanger was initiated in June 1965. Primary goals were high thermal perform- 
ance, high reliability, and good structural integrity. 

The initial heat-exchanger configuration incorporated a nickel- chromium braze 
alloy in bonding the side panels to the core. During the testing of lunar test article 
number five (LTA- 5) at WSTF, one of the side panels separated from the core and 
ruptured. This rupture resulted in a gross fuel leak and subsequent fire. The cause 
of this failure was traced to the factory test of the rig; the heat exchanger had been 
subjected to cryogenic temperatures with water in the fuel passages. Cryogenic tem- 
peratures caused freezing of the water that resulted in structural failure of the nickel- 
chromium braze material. Subsequent exposure to system -operating pressure at 
WSTF resulted in a rupture of the side panels. Two items were implemented to avoid 
this problem on subsequent vehicles. The nickel -chromium braze was changed to a 
gold-alloy braze to increase the bonding strength of the side panels, and water was 
eliminated from cold-flow testing of vehicles when cryogenic helium was used. 

Latching solenoid valve . - During the initial design of the latching solenoid valve, 
use of nylon and butyl O-rings was considered adequate for a 3. 5-day exposure to pro- 
pellant vapor. By mid- 1966, tests had proved that backup rings and lubricants were 
necessary to prevent severe chewing of the butyl O-rings during cycling. Conducted at 
a private research institute, parallel compatibility tests proved the nylon seat was in- 
adequate. Late in April 1966, the seat material was changed to the present Teflon 
material. Other design changes resulting from the tests were the replacement of 
Teflon backup rings with Teflon cap seals and the incorporation of electromagnetic - 
interference suppressors. 

In November 1967, the latching solenoid valve, installed in a prototype descent 
stage number two (PD-2) at WSTF, failed to remain in the latched-open position after 
a rapid open-close command. The problem resulted because of residual magnetism in 
the latch plunger that exceeded the spring- return force when the valve was cycled 
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rapidly. The design changes to eliminate this problem were a high-rate latch spring, 
a modified latch plunger (to house the new spring), and shims to maintain the required 
latch-spring force on assembly of each valve. Two valves were subjected successfully 
to qualification tests that were completed in the spring of 1968. 

In March 1968, the latching solenoid valve on the LM-3 vehicle was leaking ex- 
ternally through the valve body-tube nickel- chromium brazed joint. The solenoid valve 
was redesigned for LM-5 and subsequent vehicles with a brazed joint that had the proper 
clearances and that used gold-nickel alloy as the braze material. To certify the sole- 
noid valves for LM-3 and LM-4, a special test program was successfully completed 
with the nickel-braze configuration. Because the valves were not to be flown on lunar- 
landing missions, a program decision was made to accept the potential occurrence of a 
leakage failure on LM-3 and LM-4. A delta qualification test program was conducted 
successfully to certify the gold-braze configuration for flight. 

Helium pressure regulator . - The development of a pressure regulator for the 
pressurization system was initiated in June 1964. The development of this regulator 
was troubled by many problems, especially internal and external leakage. The regu- 
lator failed to meet the slam-start requirements (lockup with high pressure upstream 
and initially with vacuum downstream coupled with minimum downstream volume). 
Cracking of the main poppet and high lockup pressure were the two major problems 
during slam starts. Unavailable hardware was a problem that restrained the develop- 
mental program. 

In October 1966, an alternate vendor was selected for development of a pressure 
regulator. In mid- 1967, the alternate vendor was selected for continued development, 
and the first vendor was terminated. The newer regulator exhibited a pressure- 
spiking characteristic during slam starts although it locked within the maximum limit 
of 251 psia. The spike was as high as 266 psia in the vicinity of the burst disk and re- 
lief valve. No corrective action was made to the regulator; however, this phenomenon 
was specified as a design requirement for the burst disk. 

Two incidents of contamination in the reference sensor port resulted in high 
lockup pressures. One incident of wide-open failure on the primary stage was caused 
by contamination in the pilot poppet seat. The failures resulted from inadequate con- 
tamination control; thus, special precautions were implemented to prevent their oc- 
currence on flight parts . 

Quad check valves. - The quad-check-valve design was used in the ascent propul- 
sion system and DPS. Conducted on two valves, the qualification test program was 
completed successfully in November 1966. Some of the valves did not meet the initial 
specification of 10 scc/hr; however, the actual leakage rates were acceptable for the 
LM missions. The maximum-allowable leakage was increased to 100 scc/hr for each 
element and to 100 scc/hr for the overall valve. Excessive leakage later occurred on 
several flight vehicles. In August 1968, failure analysis conducted on internally leak- 
ing check valves indicated that most of the internal leakage problems experienced on 
the LM vehicles were caused by contamination on the seat. Investigation of these fail- 
ures led to modification of the assembly, installation, and cleaning procedures at the 
facility of the vehicle contractor and at the facility of the component vendor. 
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Propellant Storage and Feed System 

The development and qualification of the propellant storage and feed system were 
conducted on a component and a system- level basis. Early evaluation tests were con- 
ducted on the feedline and parallel-tank balance-line configuration by use of a heavy- 
weight test rig. The major objectives of these tests were to determine the effectiveness 
of the propellant utilization and the propellant management control under system- 
operating flow conditions. The major concern was evidenced at maximum thrust be- 
cause differences in system pressures would cause maximum propellant unbalance. At 
reduced thrust, the engine -cavitating venturis provided the major propellant -utilization 
control. No major problems were discovered during these tests. 

Propellant-storage tanks . - Considerable weld porosity was experienced early in 
the Apollo Program. This porosity required some rewelding; however, as experience 
was gained, porosity was gradually reduced by adjusting weld speeds and amperages . 
Also, some membrane distortion was experienced in the heat-affected zones; however, 
this problem was not major. 

During the proof-pressure test of tank S/N P-009 (March 8, 1965), rupture oc- 
curred at a pressure of 267 psi. The required proof pressure was 360 psi. The pre- 
mature failure was traced to a massive alpha inclusion in the upper dome near the 
helium-inlet boss. The source of the inclusion was not determined; however, the 
vendor speculated that it probably occurred during smelting operations when a small 
piece of oxidized titanium dropped off the side of the vat into the slurry at the time of 
solidification. The metals company was advised of this fact so that the possibility of 
recurrence could be minimized. 

During the helium-leakage testing of tank S/N G-029 (August 23, 1966), rupture 
occurred at a pressure of 180 psi. This rupture happened after the tank had been 
proof tested. Failure was traced to stress corrosion in the cover (access door). 

Early in the Apollo Program, the covers were made of titanium alloy (6A1-4V). How- 
ever, a careful analysis indicated that weight could be saved by changing the material 
to aluminum alloy because of the large amount of low-stress material in the bosses. 
Previously, these covers had been proof tested with uninhibited tapwater as the fluid. 
Initiation of the stress corrosion that caused the tank failure probably occurred during 
the uninhibited water proof test because aluminum alloy (2014-T651) is susceptible to 
stress corrosion under these conditions. Therefore, the decision was made to return 
to the use of titanium-alloy covers . 

In the feasibility tests, no major problems were experienced with the tank. How- 
ever, numerous cracks were found in the contractor-furnished support skirt and deck. 
These cracks were found after the vibration tests were conducted in the X-X axis. 

Also, some cracks occurred in the plumbing support brackets, and minor cracks oc- 
curred in the baffles. In some cases, the deficiencies were corrected by increasing 
the material thickness; in other cases, they were corrected by elimination of stress 
risers. 

Early in the Apollo Program, the seals between the tank and the cover (access 
door) were to be of butyl rubber SR 634-70. However, this material tends to deteri- 
orate above 90° F after exposure to nitrogen tetroxide. The seals were replaced with 
a different design composed of a V-shaped stainless-steel ring coated with Teflon. 
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The weight-improvement program involved changes to the stub support skirt, to 
the flanges at the cover attachment, and to the cover itself. The stub skirt was short- 
ened, and the spaces between the rivet holes were scalloped to remove useless mate- 
rial. The elimination of one of the seals, which caused considerable difficulty in 
subsequent helium- leak checks, allowed material to be removed from the tank and 
cover flanges . 

Stress corrosion from nitrogen tetroxide was a major problem; thus, several 
solutions were considered, including coating the walls with Teflon, shot peening the 
wall surfaces, changing the tank material, and changing the propellant nitrogen- 
tetroxide specification. The nitrogen- oxide content in the nitrogen tetroxide was in- 
creased to inhibit the stress corrosion by nitrogen tetroxide. In the Apollo Program, 
this problem was universal in systems using nitrogen tetroxide . 

Propellant quantity gaging system . - The development of a propellant quantity 
gaging system (PQGS) was initiated in January 1966. The initial requirement for cali- 
bration accuracy of the continuous -quantity probes was +0.25 percent throughout the 
full range. Because of the configuration of internal wiring, standoffs, et cetera in the 
space between the inner and outer electrode, this accuracy requirement could not be 
met; thus, the accuracy requirements were changed. No associated weight penalty 
was present in the budgeted propellant; however, the propellant uncertainty in the in- 
dicated quantity at the mission redline was greater. Low-level sensor accuracy was 
not affected. The revised accuracies are presented in the following table. 


Range, percent 

Accuracy, percent 

0 to 8 

±0.5 

8 to 25 

±0.25 

25 to 95 

±0.5 


During vibration qualification tests (Y axis) of the PQGS probe, the outer elec- 
trode incurred a crack adjacent to a rivet hole. The vibration qualification require- 
ments were more severe than those required for flight. The vibration levels were 
redefined to more realistic (representative of flight) values. Subsequently, the PQGS 
probes passed the vibration qualification test. During tests at WSTF and on the flight 
vehicles, the fuel-quantity indicators exhibited an initially low value (90 to 95 percent 
for full tanks) when the PQGS was first started. In approximately 15 minutes, the 
indications achieved the correct or nearly correct full reading of 95 percent (high off- 
scale). Although this time-lag anomaly was not fully understood, it was attributed to 
a conductivity gradient in the fuel caused by trace amounts of contaminants. Heat 
from the sensor electronics on the bottom of the probe tended to disperse this conduc- 
tivity gradient. 

Excessive leakage occurred at the flange -to -tank door-joint seal on LM-1. This 
excessive leakage was attributed to inadequate flatness of the flange when the bolts 
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were torqued, putting uneven compression on the single Teflon O-ring. A 3/8-inch 
stainless-steel backup ring was added to the flange to improve the flatness when the 
bolts were torqued. Also, a secondary injectant-sealant groove was cut in the tank- 
door flange to provide a backup seal. This groove was injected with a viscous sealant 
(Nitroso for the oxidizer and Vistanex for the fuel) before bolt torquing and primary 
seal-leak checks. 


Descent Engine 

A parallel developmental effort was conducted in the initial part of the descent- 
engine program. The engine throttling concepts and the selection of the final throttling 
concept are discussed in the following paragraphs . 

Helium-injection throttling . - The development of an engine with helium-injection 
throttling that used a fixed-area injector was initiated in February 1963. The testing 
of developmental hardware was started in August 1963. For the first 6 months, the 
developmental test program was paced by the limited availability of injectors. Early 
in the developmental test program of the injector, weld problems caused interpropel- 
lant leaks that resulted in catastrophic injector failures. As a result of the failures, 
a major redesign of the injector was made to allow easier fabrication and better in- 
spection of the injector. 

Combustion- stability problems occurred in early injector developmental tests. 
The self-induced instability was predominantly first-tangential mode resonance (high 
frequency). A Y-baffle arrangement was incorporated on the injector face to damp the 
instabilities. From limited tests, the high-frequency self-induced and bomb- induced 
instabilities appeared to be damped by the baffles; however, a low-frequency buzz 
(200 to 500 hertz) and intermittent high-amplitude disturbances (popping) were two 
other forms of combustion instability that remained. Severe baffle erosion and under- 
cutting of the ablative chamber near the baffles resulted during the buzz instabilities. 
Mainly, the buzz instability was a problem at reduced throttle, and it was present with 
and without helium injection. 

Other developmental problems with the engine included performance degradation 
(as the engine was throttled to reduced thrust) and excessive ablative chamber-throat 
erosion at midrange thrust. 

Variable-area- injector throttling . - The development of an engine using a 
variable-area injector (fig. 9) was initiated in July 1963. Testing of developmental 
hardware for this engine began in January 1964. 

No major combustion- stability problems were encountered with this injector 
configuration. The lack of stability problems was attributed to the inherently stable 
design of the center- element injector, which minimized energy release near the cham- 
ber walls where most high-frequency instability modes are sustained. However, 
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combustion roughness was experienced, 
which was a random-type pressure oscil- 
lation with no cyclic resonant frequency. 
The source of this combustion roughness 
appeared to be primarily the coarse in- 
jector design. The relatively few oxidizer 
streams (36 primary and 36 secondary) 
provided a source of uneven combustion. 
Bomb tests were performed at various 
positions in the chamber , and no incidence 
of combustion instability occurred. The 
bomb tests were performed in a steel-wall 
combustion chamber to minimize the 
natural damping effect of the ablative 
chamber. 

Throat erosion of the ablative cham- 
ber was significantly higher than that 
usually associated with fixed-thrust en- 
gines. The greatest rate of erosion oc- 
curred at full thrust. Some occurrences 
of excessive heating and bulging of the 
titanium case of the throat section were 
observed during heat soakback following a 
long full-thrust burn (approximately 
400 seconds). This effect occurred after 
engine shutdown and was not indicative of 
a potential burnthrough. 

a decision was made to continue development 
of the variable-area-injector engine and to terminate development of the fixed-area- 
injector helium-injection engine. This decision was based upon an evaluation of the 
developmental problems and the progress that occurred from initiation of each of the 
engine programs until the selection time. The variable-area-injector engine was se- 
lected because of better combustion stability and better combustion performance 
throughout the range of thrust. Because of better combustion stability and better per- 
formance profile, fewer problems were anticipated in the development of the engine. 
The increased mechanical complexity of the throttling mechanism gave the variable- 
area-injector engine a lower reliability than the fixed-area-injector helium -injection 
engine . 

Engine developmental problems . - Because the engine qualification configuration 
had to be selected before all developmental problems were resolved completely, the 
engine qualification was conducted in two phases. The phase-A qualification was con- 
ducted simultaneously with continued engine development to meet the early delivery 
requirements for the vehicle engine. The phase-B engine qualification was initiated 
in January 1967 and was completed in August 1967. 

The original injector pintle tip (figs. 9 and 10) was made of stainless steel, and 
it incurred severe erosion during engine operation because of inadequate cooling. As a 
result of the erosion, copper slugs were incorporated in the pintle tip to promote better 
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Figure 9. - Cross section of LM 
descent-engine injector. 


Engine selection. - In January 1965, 
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heat transfer. This configuration was used in the first engine qualification design 
(phase A). In the phase-B qualificational engine, a columbium -alloy pintle tip was 
used because the copper-slug configuration did not eliminate completely the erosion. 

No erosion occurred with the columbium tip. 

The phase- A injector exhibited very uneven throat -erosion patterns with severe 
gouging in local areas. This gouging was caused by poor injector-inlet hydraulics on 
the oxidizer side; therefore, a small step (a turbulator) was added to the oxidizer- 
inlet tube of the phase-B injector to provide an even velocity distribution in the oxidizer 
fans. As a result of this addition, uneven throat erosion was reduced greatly and goug- 
ing was eliminated. 

The ablative thrust chamber of the phase-A engine had a slotted turbulence ring 
approximately 5 inches downstream from the injector face. The turbulence ring was 
eliminated on the phase-B engine to allow the flow of fuel-barrier coolant to extend 
farther down the wall of the chamber and to reduce throat erosion. 

During the phase-B qualification test, gouging did occur on one engine. The 
gouging was traced to one of the fuel-barrier cooling orifices being plugged by room- 
temperature vulcanized (RTV) rubber, which was used as a seal around the tubes of the 
cooling orifice at the ablative faceplate. A process change was made to prevent plugging 
of the fuel-barrier cooling orifices during assembly. Also, during the phase-B quali- 
fication test, one engine incurred a failure of the electron-beam (EB) weld on the guide 
bar that positions the oxidizer sealing ring (fig. 10). This failure also occurred on 
several WSTF engines, and in some cases, the guide bar came completely out from 
under the oxidizer sleeve. Subsequently, an EB tack weld in the center of the guide 
bar was changed to a structural EB weld around the periphery of the guide bar. 

During systems tests at WSTF, 500-hertz oscillations in pressure were observed 
in the oxidizer-injector manifold at approximately 40-percent thrust on several engines. 
The worst case of these oscillations was as high as 300 psi peak-to-peak. Initially, the 
oscillations could not be duplicated on engine-test stands at the facility of the vendor. A 
special investigation was conducted at WSTF and at the facility of the engine vendor to 
determine the cause of the oscillations and to determine whether they had any detri- 
mental effect on the engine. This investigation included a special instrumented engine 
test to evaluate the effects of gas saturation, instrumentation installations, and struc- 
tural oscillation; tests and studies to evaluate the effects of special flow-control-valve 
cavitation; and tests to evaluate the effects of special instrumentation dynamic response. 
From these investigations, the oxidizer-manifold oscillations were determined to be 
the result of small-amplitude (5 psi peak-to-peak) oscillations from the flow-control- 
valve cavitation process (at approximately 40-percent thrust); these oscillations were 
being amplified only in the pressure transducer line. The 500-hertz oscillations were 
observed to a lesser degree at the engine feedline interface. The chamber pressure 
was insensitive to the 500-hertz oscillations. A more detailed summary of this investi- 
gation is found in reference 2. 
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Section A-A 


Figure 10. - Pintle-assembly diagram 
showing guide-bar installation. 


Several engines exhibited resonant 
100-hertz oscillations in chamber pressure 
at approximately 25-percent thrust. These 
oscillations were in the order of 10 psi 
peak-to-peak. From the 500-hertz test, 
the oscillations were found to be damped 
by the presence of helium saturation in the 
propellant . Previous engine testing had 
been done without helium- saturated pro- 
pellants . Helium saturation is representa- 
tive of the propellant conditions in flight. 

During the development and qualifica- 
tion of the engine shutoff valve (SOV), 
several minor problems occurred. A 
chronic problem was SOV rotor-seal leak- 
age. Generally, the seals met the 
10-scc/hr leakage requirement for gas- 
eous nitrogen, but they were sensitive to 
contamination and scoring. The major 
causes of leakage were cycling of the 
rotors in the dry condition and long-term 
propellant exposure, which generated 
residue contaminants. The allowable num- 
ber of dry cycles before launch was limited 
to 250. Also, special precautions were 
taken to reduce the valve-actuation time 
during dry cycling (approximately 2 to 
3 seconds) to prevent seal damage caused 
by very rapid actuation. Contamination 
leakage was corrected by replacing leaky 
seals before engine delivery. 


In the testing of developmental and WSTF engines, several instances of rack 
jamming or sluggish valve actuation occurred. This problem was caused by oxidizer 
leakage past the shaft seals (fig. 11) into the gear cavities and by subsequent reaction 
of the oxidizer with the gear lubricant. No cases occurred where the valve completely 
jammed, but all cases resulted in sluggish valve actuation on the affected rack. The 
gear cavities on all flight engines were checked for leaks and acidity (pH factor) before 
delivery. Also, a force-pressure check to detect sluggish valves was performed atthe 
plant of the contractor and at the NASA John F. Kennedy Space Center to measure the 
pressure for cracking and full-open actuation of each of the four actuators. 


The valve position for each actuator was indicated by reed switches. During 
development and qualification, the switches were unreliable and gave false indications. 
The cause of these failures was not fully understood, but it was thought to be caused 
by the engine -vibration environment and delicately constructed reed switches. After 
the flight of LM-1, on which a false indication was noted, a reevaluation of the need 
for valve-position indication was made. Because no mission decision required the 
use of valve position and because of the unreliability of the reed switches, the switches 
were eliminated with a resultant savings in weight of approximately 1. 5 pounds. 
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Figure 11.- Exploded view of oxidizer 
section of engine shutoff valve. 



The original elbow of the flow- 
control valve (FCV) was made of stamped 
6061 aluminum sheet metal and machined 
6061 aluminum flanges (fig. 12(a)). The 
elbow was welded together as shown in 
figure 12(a). During qualification tests, 
cracks occurred in a weld near the flange; 
these cracks were caused by the closeness 
of the weld to the flange, which resulted 
in a stress concentration. Because of the 
design, the weld was very difficult to in- 
spect. The elbow was redesigned to relo- 
cate the weld farther from the flange to 
improve the strength and inspectability. 
The redesigned elbow passed qualification; 
however, during production of elbows for 
flight engines, several elbows cracked 
during the proof-pressure test (540 psig). 
These cracks occurred in a weld adjacent 
to the throttle- linkage boss. An X-ray of 
the weld in this area showed that some 
elbows had a void in the weld caused by 
inadequate penetration from the welds 
made on the inner and outer surfaces of 
the elbow. Subsequently, all elbows were 
inspected by X-ray for voids in the welds. 
Because this inspection screened the in- 
adequate welds, it resulted in a high rate 
of scrappage. A new two-piece elbow 
(fig. 12(b)) was designed and qualified for 



(a) Sheet-metal elbow. (b) Two-piece elbow. 

Figure 12. - Flow-control valve. 


use in later flight engines. The new elbow consisted of two pieces machined from 
solid stock (6061 aluminum) and joined by a single weld in an easily inspectable area. 
This elbow configuration was incorporated in one of the phase-B qualification engines. 
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During production of phase-B engines, an FCV retaining nut was found to have a 
fatigue crack in the root of a thread. Further investigation revealed that the fatigue 
crack occurred during water-flow calibration of the FCV. At certain thrust levels 
(approximately 10 percent), the water flow produced excessive pressure oscillations 
in the cavitating venturi that resulted in fatigue of the retaining nut. This phenomenon 
was associated with the water-flow test but was not associated with propellant-flow 
conditions . Because the retaining nuts on all flight engines were susceptible to the 
problem, corrective action had to be taken. Provided the upper part of the nut was not 
free to move, structural failure of the nut would not result in any adverse effect on the 
engine. Therefore, all engines were modified (in the field for delivered engines) by 
applying epoxy beneath the retaining nut, thus bonding it in place if it cracked com- 
pletely through. 

During development and qualification, the engine-pressure transducers (chamber 
pressure and injector pressures) acquired a calibration shift after exposure to propel- 
lant and atmospheric environment. This calibration shift was traced to etching of the 
transducer diaphragm by acid formed from residual propellant and moisture. To pre- 
vent this problem, the flight-engine pressure transducers on all delivered engines 
were installed after acceptance firing and after cleaning the engine for delivery. 


TEST SUMMARY 


At WSTF a comprehensive ground-test program was conducted to develop and 
certify the DPS for lunar landing. This test program encompassed approximately 
3-1/2 years. Testing started early in 1966 and continued through mid- 1969. The test 
program used three propulsion-test rigs. 


Descent-Propulsion Developmental Vehicle 

The PD-2 propulsion rig was used for high-altitude firings. The PD-2 employed 
a flightweight primary structure and a secondary structure designed for small titanium 
propellant tanks and prototype propellant components. Tests performed on the PD-2 
included substitute- and live-propellant cold-flow tests, off-nominal start and operating 
characteristics, component malfunctions, vehicle mission-duty cycle firings, and 
500-hertz oxidizer-manifold oscillations. 


Lunar Test Article 5 

The LTA-5 was a full-scale LM descent stage with a complete production DPS. 

On July 3, 1967, following completion of the first system test (LM-1 mission-duty 
cycle (MDC)) and while still at altitude, the fuel-helium heat exchanger ruptured. 

During facility-securing operations, fuel that leaked from the heat exchanger was ig- 
nited by an unknown source. As a result of the ignition and consequent fire, LTA-5 
was damaged extensively. Subsequently, the LTA-5 was refurbished to approximately 
the LM-3 and LM-4 configuration, and it was redesignated LTA-5D. Two tests, one 
in support of mission B (LM-1) and one in support of mission D (LM-3), were conducted 
before the start of mission- G testing. 
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Five MDC tests were accomplished to support the lunar- landing mission (mis- 
sion G). The tests were performed to demonstrate the capability of the DPS to per- 
form the mission-GMDC under nominal conditions, off-nominal conditions, and 
malfunction conditions. All of the tests were made with propellants that were satu- 
rated with helium after gaseous nitrogen had been removed. In addition to the MDC 
tests, one SPS abort-duty cycle was conducted in which two long DPS firings were per- 
formed that had a long coast in between. 


FLIGHT EXPERIENCE 


Apollo 5 (LM-1) 

The LM-1, the first flight LM, was launched on January 22, 1968, by a Sat- 
urn IB. The LM-1 was flown in an unmanned earth-orbital mission to evaluate sub- 
system flight performance and to verify manrating. 

System configuration . - The DPS was basically the same as the lunar -landing 
configuration (LM-5) except for the following differences. 

1. The pressurization system did not include an ambient-helium start bottle. 

2. The fuel-to-helium heat exchanger was an early configuration that utilized a 
nickel- chromium brazing alloy for structural bonding. 

3. The propellant-tank manual -venting system (lunar-dump system) for lunar- 
surface venting was not incorporated on this vehicle. 

4. The propellant-tank door seals and various other tank and inline flange seals 
were different from the final LM-5 configuration. 

5. The propellant-tank burst disk was an early design that had a higher nominal 
setting and a larger tolerance band on the burst pressure. 

Flight problems . - During the flight of LM-1, two anomalies were associated 
with the DPS. The first anomaly was the premature shutdown of the first descent- 
engine burn. The second anomaly occurred in the second and third descent-engine 
burns in which an engine-propellant SOV out-of-phase indication occurred. 

Premature shutdown of first descent- engine burn: The first descent-propulsion 
maneuver, controlled by the primary guidance, navigation, and control system, was 
scheduled to last approximately 38 seconds. The descent- engine thrust monitor was 
programed to stop the engine if any three consecutive 2-second-accelerometer sam- 
ples (taken after the commanded ’’engine on”) indicated an accumulated velocity of 
less than 45 cm/ sec. This criterion was based on a nominal engine start with the pro- 
pellant tanks initially at full-operating pressure and with the helium supply on line. 

The LM-1 did not have an ambient-start helium-storage tank, and theSHe tank 
was isolated by the three explosive valves that were fired automatically by the pyro- 
technic system 1. 3 ± 0. 3 seconds after the first "engine on" command. Therefore, 
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the system pressures during the first DPS start, which were normal for this particular 
system configuration, did not rise fast enough to meet the thrust-time criteria pro- 
gramed into the guidance computer. All logic and circuits that could command any 
engine cutoff or inhibit any engine start were reevaluated to prevent unnecessary en- 
gine shutdown on subsequent flights. The thrust-monitor logic was the only circuit 
found to produce a premature engine shutdown. 

Out-of-phase indication from descent-engine propellant shutoff valves: During 
the transition from 10-percent throttle to full throttle on the second and third descent- 
engine firings, an out-of-phase indication was received from one pair of the two-pair 
position switches that indicate the position of the eight propellant shutoff valves. The 
out-of-phase indication remained until the end of both firings. 

An investigation was conducted to determine the cause of the phasing anomaly. 
The primary areas investigated as possible causes for the out-of-phase indication 
were as follows . 

1. Reed-switch failure (false indication) 

2 . Pilot- valve or actuator-hydraulic malfunction or leakage (valve failed full or 
partially closed) 

3. Electrical-circuit failure (valve failed full or partially closed) 

This investigation could not establish conclusively a single cause or combination of 
causes as the basis for the observed phasing anomaly. However, because of the past 
unreliability of the reed switches, the most likely cause of the anomaly was concluded 
to be a false indication by the reed switch. A decision was made that the reed switches 
should be eliminated from LM-5 and subsequent vehicles. 


Apollo 9 (LM-3) 

The LM-3 was the second LM to fly. The LM-3 was flown in a manned earth- 
orbital mission launched on March 3, 1969. The LM-3 mission was a 10-day flight to 
qualify the LM for future flights and to demonstrate certain combined spacecraft func- 
tions for manned lunar flight. 

System configuration. - Two major configuration differences between the LM-3 
and the LM-1 DPS were evidenced. The LM-3 incorporated the ambient-helium 
pressurization-start system to allow prepressurization of the propellant tanks before 
the first burn. The LM-3 also incorporated a lunar dump- valve venting system on 
each set of the propellant tanks. The LM-3 guidance computer program was modified 
to prevent the inadvertent AV cutoff phenomenon experienced on the LM-1 flight. 

Flight problems . - During the flight of LM-3, three anomalies associated with 
the DPS occurred. 

The SHe tank internal-heat-exchanger freezing: During the first 35 seconds of 
the first descent-engine firing, the regulator outlet- manifold pressure decreased from 
235 to 188 psia. The regulator should have regulated at 247 psia (fig. 13). The 
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Time, hr:min : sec Time, hr:min:$ec 


(a) Chamber. (b) Fuel interface. 



49 : 41:20 49 : 41:40 49 : 42:00 49 : 42:20 49 : 42:40 49 : 43:00 
Time, hnminisec 

(c) Oxidizer interface. 



49 : 41:00 49 : 41:20 49 : 41:40 49 : 42:00 49 : 42:20 49 : 42:40 49 : 43:00 

Time, hr-.min-.sec 

(d) Regulator outlet. 


temperature data indicated that the in- 
ternal heat exchanger initially was blocked. 
At approximately 35 seconds after engine 
ignition, the blockage cleared and allowed 
the regulator outlet-manifold pressure to 
rise to the proper operating level. 


^ * During final servicing of the SHe 

49?4i:2o 49:4i:4o 49:42:00 49:42:20 49:42:40 49:43:00 tank for flight at the launch complex, an 

Time, hr ; min:sec event occurred that caused concern. After 

/Sc , ... , , ,. . . the SHe tank had been topped-off and the 

(e) Supercritical helium tank. helium heat . exchanger 4 nil0ld vented t0 

Figure 13 - Aoollo 9 DPS oressures approximately 25 psia, an inadvertent vent- 

Figure is. Apollo 9 DPb pressures ing Qf the helium heat-exchanger manifold 

uring star o irs iring. to a pp rox i ma t e iy atmospheric pressure oc- 

curred while the vehicle quick-disconnects 
were being warmed by a helium purge to 

allow their disconnection. During the quick-disconnect purge, the supply pressure 
probably was allowed to drop below atmospheric pressure, and outside air probably 
was cryopumped into the helium manifold by the cold heat exchanger in the SHe tank. 
Subsequently, the air was condensed and frozen in the near-liquid-helium temperature 
environment of the internal heat exchanger. To isolate the purge system from the 
helium-manifold pressure-control system, the GSE was modified for subsequent flights. 
In addition, continuous pressure recording with proper scaling was employed on the 
helium manifold. 


The SHe system leak: The pressure in the SHe tank for the DPS began decaying 
at the rate of 2.9 psi/hr immediately after termination of the first descent-engine 
firing. The pressure decay continued until staging. Because of heat transfer into the 
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tank, the pressure normally increased under no-flow conditions. Calculations showed 
that a leak of about 0. 1 lb/ hr would have caused the 2.9-psi/hr pressure -decay rate. 

A failure of an internally brazed squib valve was found during drop tests of LM-2 
at the NASA Manned Spacecraft Center. The failure was caused by a crack in the braz- 
ing material, which was thin in the failed area. The time of the failure could not be 
ascertained; however, it probably was caused by the shock of the squib firing to pres- 
surize the ascent propulsion system. 

The LM-3 SHe squib valve was similar to the LM-2 squib valve in that the valve 
fittings were internally brazed, which prevented inspection of the joint. The leak ex- 
perienced during Apollo 9 probably was caused by a defective braze that was internal 
to the squib valve and could not be inspected. 

The mission criticality of external leakage was evaluated for each of the squib 
valves on the Apollo 10 vehicle. On the DPS, the oxidizer-compatibility squib valve 
was determined to be of the internal- braze configuration; thus, if external leakage de- 
veloped, it could have been hazardous to the mission. Therefore, this valve was modi- 
fied to incorporate RTV potting reinforced with an external clamp (fig. 14) to contain 
any leakage if the brazes cracked. This configuration was thoroughly tested before the 
flight. The valves on all vehicles subsequent to Apollo 10 were of the external-braze 
configuration. 





Figure 14.- The SHe squib- valve configuration. 
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Engine roughness: During the second descent- engine firing, rough combustion 
was encountered at approximately 27-percent thrust as the engine was being manually 
throttled from 12 to 40 percent. This roughness lasted for approximately 2. 5 seconds, 
during which time the crew delayed increasing the throttle. The resultant transients 
in propellant- injector pressures and chamber pressure are shown in figure 15.. 



(a) Thrust chamber. 



(c) Oxidizer injector. 


Figure 15.- Comparison of roughness 
during second descent- engine firing 
and ground test. 


that the zero-g-can retention screen was n 
114-inch head between identical propellant 



(b) Fuel injector. 


Ground-test data of engine pressures 
as helium was deliberately ingested into 
the engine are superimposed on figure 15. 
The similarity of data indicates that helium 
ingestion was the probable cause of the 
roughness . A possibility existed for 
helium bubbles to migrate into the propel- 
lant feedlines from the propellant tanks , 
which had 60-percent ullage volume after 
the first burn. This migration would re- 
sult from lateral or rotational vehicle ac- 
celeration (or both) combined with the fact 
: capable of holding propellants at the 
inks (fig. 16). 


Helium ingestion requires that the zero-g can be uncovered and that lateral or 
rotational accelerations be present. This condition was highly probable with the 
60-percent ullage volume present in Apollo 9 propellant tanks before the second descent- 
engine firing. Tests have demonstrated that ingestion of helium into the engine in this 
manner has no detrimental effect on the system . 
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Apollo 10 (LM-4) 

The LM-4, the third LM to fly, was the second manned LM flight. Launched on 
May 18, 1969, the LM-4 mission was an 8-day trans lunar and lunar-orbital mission 
designed to confirm all aspects of the lunar-landing mission exactly as it would be per- 
formed, except for the actual descent, landing, lunar stay, and ascent from the lunar 
surface. 

During the phasing burn, the crew reported two occurrences of a master alarm 
caused by a propellant-quantity low-level indication. The first alarm was coincident 
with engine "on” command, and the second alarm was noted immediately after throt- 
tling to FTP. The crew reset the master alarm after the first low-level alarm, and 
the low-level indication was reported to have ceased working at that time. 

The low-level indication probably was caused by a gas bubble in the unsettled 
propellant uncovering the low-level sensor before the burn but after turning on the 
PQGS. Once the low-level sensor was uncovered, the indication was latched on by a 
latching relay and remained on until the PQGS was turned off again after completion of 
the burn. The crew display of low quantity was inhibited until the engine "on" com- 
mand was given, thus explaining the master alarm at the time of engine ignition. This 
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fact was verified by the telemetry re- 
cording of the low-level indication during 
the phasing burn (fig. 17). The second 
alarm (immediately after throttle up) 
could not be verified by telemetry data 
nor explained by normal system opera- 
tion. On subsequent missions, the low- 
level indication was removed from the 
master alarm because a visual indication 
by the low-level warning light was con- 
sidered adequate warning for the crew. 
Also, if the low-level indication occurred 
at engine ignition, a contingency crew 
procedure was instituted to reset the 
low-level indication by cycling the 
PQGS off and on. 
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Figure 17.- Master alarms during 
Apollo 10 phasing maneuver. 


Apollo 11 (LM-5) 

The LM-5, the first lunar-landing vehicle, was the fourth production LM to fly. 
The primary objective of the Apollo 11 mission was to perform a manned lunar landing 
and to return safely to earth. At landing, the quantity of propellants remaining in each 
of the four tanks was as follows. 

1. Oxidizer tank 1 : 5. 7 percent 

2 . Oxidizer tank 2 : 2.7 percent 

3. Fuel tank 1: 3.9 percent 

4. Fuel tank 2: 3.9 percent 

The minimum-usable quantities, based on the indication of oxidizer tank 2, allowed a 
remaining hover time of 63. 5 seconds. Several minor anomalies occurred in flight. 
During the power-descent-initiation (PDI) burn, the oxidizer-engine-inlet pressures 
indicated low-frequency oscillations that varied from 24 psi peak-to-peak during the 
FTP operation to 67 psi peak-to-peak during throttle recovery (approximately 
57-percent thrust). The oscillations observed were characteristic of those observed 
in oxidizer-injector manifold and engine-inlet pressures in several ground-test en- 
gines, which were verified to be harmless to engine or system operation. 

During the last 140 seconds of the PDI burn (hover phase), a series of large 
oscillating- throttle changes occurred (fig. 18). These changes were approximately 
15 percent peak-to-peak about a nominal throttle setting of approximately 26 percent. 
Large and rapid changes in vehicle attitude (as much as 15 at 10°/sec) in pitch 
during the final phases of landing caused centrifugal accelerations on the inertial- 
measurement -unit accelerometers located at the top of the ascent stage high above the 
vehicle c.g. , thereby giving a false indication of vertical acceleration. This false in- 
dication caused the lunar guidance computer to command a throttle change to com- 
pensate for an unreal change in vertical acceleration. Later, this problem was 
investigated under the analysis of the guidance and control system. 
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(a) Measured automatic -command voltage. (b) Measured chamber pressure. 
Figure 18.- Apollo 11 hover-phase throttle profile. 


During the PDI burn, the oxidizer quantity in tank 1 and tank 2 diverged, as ob- 
served by the PQGS readings, until, at 360 seconds into the burn oxidizer, tank 2 was 
approximately 3.4 percent less than oxidizer tank 1. This divergence in remaining 
oxidizer quantity was attributed to propellant transfer from one oxidizer tank to the 
other through the propellant balanceline during the burn. The offset in the vehicle c. g. 
from the centerline between the oxidizer tanks (on Z axis) resulted in the tilting of the 
vehicle in that axis to put the thrust vector through the vehicle c.g. (fig. 19). This 
tilt caused preferential feeding from the tank that was highest with respect to vehicle 
c.g. Although the observed magnitude was less than the calculated magnitude, calcu- 
lation of propellant transfer between the two tanks, based on the known geometric head 
difference, confirmed the transfer of propellant from oxidizer tank 2 to oxidizer tank 1 
Adjustments were made to the propellant margin to account for this difference. 


At 685 seconds into the PDI burn, the propellant- low- quantity warning light was 
triggered by the sensor in one of the four propellant tanks. Based on remaining calcu- 
lated quantities and corrected PQGS indications, the occurrence of the propellant- low- 
quantity warning was discovered to be premature by 36 seconds. The early warning 
was the result of propellant slosh waves created by sudden vehicle maneuvers and by 

attitude changes. These slosh waves 
caused the propellant level in the PQGS 
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Figure 19 . - Schematic of propellant 
unbalance. 


probe to oscillate about a negatively biased 
level. At the lowest point of the oscilla- 
tion, the low-level sensor was momentar- 
ily uncovered, thus latching a relay to the 
warning light. 

Before the flights of Apollo 11 and 12 
(during which the anomaly was observed) a 
ground-test program was conducted in 
which the critical slosh modes were iden- 
tified and potential modifications to elim- 
inate or reduce the error were evaluated. 
From this test program, the lateral- mode 
and ring-mode slosh were found to produce 
the most errors in PQGS readings . Slosh 
baffles were incorporated on Apollo 14 
and subsequent vehicles to minimize the 
slosh in the tanks . 
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Venting of the propellant and the 
SHe tanks after lunar landing resulted in 
the freezing of the fuel-to-helium heat 
exchanger. Fuel and oxidizer interface 
pressures as compared to time during 
the postlanding venting are presented in 
figure 20. Venting of the SHe tank 
through the lunar -dump valves resulted 
in the flow of residual cold helium into 
the SHe tank through the heat exchanger, 
thereby freezing the fuel in the fuel pas- 
sages and blocking flow of fuel through 
the heat exchanger. During the subse- 
quent hour, the engine experienced a 
peak in heat soakback from the ablative 
chamber, which caused the fuel trapped 
in the line between the heat exchanger and engine SOV to expand thermally; therefore, 
the pressure rose rapidly. After 30 minutes, the fuel pressure was relieved by thaw- 
ing of the heat exchanger, failure of the line-bellows linkage, or failure of the seals 
in the prevalve. The exact cause of relief was not determined. On subsequent flights, 
the venting procedure was modified to isolate the SHe tank by the latching solenoid 
valves during venting of the propellant tanks and to delay SHe venting until immediately 
before launch from the lunar surface. Based on autoignition tests of the fuel at vari- 
ous pressure levels, the final-vent fuel-pressure level was revised from 20 to 40 psia 
to 8 psia to prevent any autoignition hazards in the aerozine-50 fuel during engine peak 
periods of heat soakback. On LM-7 and subsequent vehicles, a bypass line around the 
heat exchanger was incorporated as an added safety feature to relieve the trapped fuel 
pressure if freezing of the heat exchanger should occur. 



Figure 20.- The Apollo 11 descent- 
propellant and helium venting. 


CONCLUDING REMARKS 


Because of the complexity caused by the throttling and gimbaling requirements 
and the use of an advanced pressurization-system concept, the DPS was one of the last 
Apollo propulsion systems to reach developmental maturity . Because the DPS was 
also a pressure-fed earth-storable hypergo lie -propellant design, as were the other 
Apollo spacecraft propulsion systems, DPS development did benefit by some of the 
knowledge gained in the earlier development of other systems . 

Testing of the DPS with substitute propellants, in the development and flight- 
vehicle-acceptance phases of the program, successfully achieved the proper pressure- 
drop balance in the subsystem, thus minimizing propellant residuals required for a 
mission. Pressure-drop balance was critical to the DPS because of the use of paral- 
lel feed tanks in the design and the criticality of propellant depletion to mission 
success. 

Early in the Apollo Program, a decision was made to incorporate a SHe pres- 
surization system into the DPS design for a vehicle-weight savings. The design of the 
pressurization system was tailored to meet the time-profile requirements of the lunar- 
landing mission. The capability of the pressurization system to perform other mission 
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time profiles, such as earth-orbital multiburn missions and many lunar-abort mis- 
sions, was limited severely. Also, this lack of capability constrained launch-delay 
turnaround time. Even though a DPS weight savings was realized, a significant pen- 
alty occurred in launch and mission flexibility. 

During development and qualification of the DPS, several unanticipated hardware 
and system problems occurred. Long-term propellant compatibility resulted in seal 
degradation and corrosion of materials supposedly compatible with the propellants . 
Contamination, which resulted in component leakage or malfunction, was another sig- 
nificant problem. For future systems of this type, steps should be taken to isolate 
critical components from excessive contamination by filters or other means. This 
isolation should include periods of component replacement in the system and normal 
system exposure. Also, the component design should be made less sensitive to con- 
tamination, if possible; a certain amount of contamination in the system is unavoidable. 

Many cases of excessive seal- leakage problems occurred, particularly in the 
propellant storage and feed system. Many of these problems resulted from minimizing 
the weight of the seal configuration, not providing adequate sealing-surface stiffness , 
and other seal-design features. 

In the design of the PQGS, two significant problem areas were encountered that 
should be avoided. In the design of the fuel probes, the accuracy of the quantity meas- 
urement was affected greatly by fuel-conductivity gradients within the fuel tanks . Trace 
amounts of contamination in local areas could change the local conductivity. This was 
a design weakness in the fuel probe. The other problem area with the PQGS was pro- 
pellant slosh near low-level quantities that caused cycling and biased readings at low 
level. A more thorough evaluation of vehicle motions near the lunar-landing point in 
the mission may have prevented encountering this problem in flight. 

Based on the experience with the DPS, system-to-system interface requirements 
are very critical, and a periodic review of system interface requirements should be 
conducted. For example, the guidance and navigation system on the LM-1 flight had a 
AV monitor that terminated the engine burn if a certain AV threshold was not met. 
This burn termination might have been avoided if the LM-1 engine-start characteristics 
had been compared with the guidance and navigation program AV monitor. 
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